Package org.elasticsearch.xpack.esql.plan.logical

Class Grok

java.lang.Object

org.elasticsearch.xpack.esql.core.tree.Node<LogicalPlan>

org.elasticsearch.xpack.esql.plan.QueryPlan<LogicalPlan>

org.elasticsearch.xpack.esql.plan.logical.LogicalPlan

org.elasticsearch.xpack.esql.plan.logical.UnaryPlan

org.elasticsearch.xpack.esql.plan.logical.RegexExtract

org.elasticsearch.xpack.esql.plan.logical.Grok

All Implemented Interfaces:

NamedWriteable, Writeable, PostAnalysisVerificationAware, TelemetryAware, Resolvable, GeneratingPlan<RegexExtract>, SortAgnostic, SortPreserving, Streaming

public class Grok
extends RegexExtract
implements TelemetryAware, SortPreserving

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	Grok.Parser

Nested classes/interfaces inherited from class org.elasticsearch.xpack.esql.plan.logical.LogicalPlan

LogicalPlan.Stage

Nested classes/interfaces inherited from class org.elasticsearch.xpack.esql.core.tree.Node

Node.NodeStringFormat

Nested classes/interfaces inherited from interface org.elasticsearch.common.io.stream.Writeable

Writeable.Reader<V>, Writeable.Writer<V>

Field Summary

Fields

Modifier and Type	Field	Description
static final NamedWriteableRegistry.Entry	ENTRY

Fields inherited from class org.elasticsearch.xpack.esql.plan.logical.RegexExtract

extractedFields, input

Fields inherited from class org.elasticsearch.xpack.esql.core.tree.Node

TO_STRING_MAX_LINES, TO_STRING_MAX_WIDTH

Constructor Summary

Constructors

Constructor	Description
Grok(Source source, LogicalPlan child, Expression inputExpression, Grok.Parser parser)
Grok(Source source, LogicalPlan child, Expression inputExpr, Grok.Parser parser, List<Attribute> extracted)

Method Summary

Modifier and Type	Method	Description
boolean	equals(Object o)
String	getWriteableName()
int	hashCode()
protected NodeInfo<? extends LogicalPlan>	info()	Normally, you want to use one of the static create methods to implement this.
List<Attribute>	output()	The ordered list of attributes (i.e.
Grok.Parser	parser()
static Grok.Parser	pattern(Source source, String pattern)
static Grok.Parser	pattern(Source source, String pattern, MatcherWatchdog matcherWatchdog)	Builds a parser using the given watchdog to interrupt expensive matches.
UnaryPlan	replaceChild(LogicalPlan newChild)
static void	rewriteGrokPattern(StringBuilder sb, String pattern, NodeStringMapper mapper)	Renders a Grok pattern of shape "%{IP:client_ip} %{NUMBER:bytes:int}".
Grok	withGeneratedNames(List<String> newNames)	Create a new instance of this node with new output Attributes using the given names.
void	writeTo(StreamOutput out)

Methods inherited from class org.elasticsearch.xpack.esql.plan.logical.RegexExtract

computeReferences, expressionsResolved, extractedFields, generatedAttributes, input, postAnalysisVerification

Methods inherited from class org.elasticsearch.xpack.esql.plan.logical.UnaryPlan

child, inputSet, outputSet, replaceChildren

Methods inherited from class org.elasticsearch.xpack.esql.plan.logical.LogicalPlan

analyzed, childrenResolved, optimized, preAnalyzed, preOptimized, resolved, setAnalyzed, setOptimized, setPreAnalyzed, setPreOptimized

Methods inherited from class org.elasticsearch.xpack.esql.plan.QueryPlan

computeExpressions, expressions, forEachExpression, forEachExpression, forEachExpressionDown, forEachExpressionUp, references, transformExpressionsDown, transformExpressionsDown, transformExpressionsOnly, transformExpressionsOnly, transformExpressionsOnlyUp, transformExpressionsUp, transformExpressionsUp

Methods inherited from class org.elasticsearch.xpack.esql.core.tree.Node

allMatch, anyMatch, children, collect, collect, collect, collectFirstChildren, collectLeaves, doCollectFirst, forEachDown, forEachDown, forEachDownMayReturnEarly, forEachProperty, forEachPropertyDown, forEachPropertyOnly, forEachPropertyUp, forEachUp, forEachUp, nodeName, nodeProperties, nodeString, nodeString, propertiesToString, replaceChildrenSameSize, source, sourceLocation, sourceText, toString, toString, toString, transformChildren, transformChildren, transformDown, transformDown, transformDown, transformDown, transformDownSkipBranch, transformNodeProps, transformPropertiesDown, transformPropertiesOnly, transformPropertiesUp, transformUp, transformUp, transformUp

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.elasticsearch.xpack.esql.plan.GeneratingPlan

checkNumberOfNewNames

Methods inherited from interface org.elasticsearch.xpack.esql.capabilities.PostAnalysisVerificationAware

postAnalysisVerification

Methods inherited from interface org.elasticsearch.xpack.esql.capabilities.TelemetryAware

telemetryLabel

Field Details

ENTRY

public static final NamedWriteableRegistry.Entry ENTRY

Constructor Details

Grok

public Grok(Source source,
 LogicalPlan child,
 Expression inputExpression,
 Grok.Parser parser)

Grok

public Grok(Source source,
 LogicalPlan child,
 Expression inputExpr,
 Grok.Parser parser,
 List<Attribute> extracted)

Method Details

pattern

public static Grok.Parser pattern(Source source,
 String pattern)

pattern

public static Grok.Parser pattern(Source source,
 String pattern,
 MatcherWatchdog matcherWatchdog)

Builds a parser using the given watchdog to interrupt expensive matches. Used by the local execution planner to bind the node-local esql.grok.watchdog.max_execution_time setting to the matcher that will actually run against real data; parsing/deserialization use the no-op watchdog above since they never execute the pattern against untrusted input.

writeTo

public void writeTo(StreamOutput out)
             throws IOException

Specified by:

writeTo in interface Writeable

Throws:

IOException

getWriteableName

public String getWriteableName()

Specified by:

getWriteableName in interface NamedWriteable

replaceChild

public UnaryPlan replaceChild(LogicalPlan newChild)

Specified by:

replaceChild in class UnaryPlan

info

protected NodeInfo<? extends LogicalPlan> info()

Description copied from class: Node

Normally, you want to use one of the static create methods to implement this.

For QueryPlans, it is very important that the properties contain all of the expressions and references relevant to this node, and that all the properties are used in the provided constructor; otherwise query plan transformations like QueryPlan#transformExpressionsOnly(Function) will not have an effect.

Specified by:

info in class Node<LogicalPlan>

output

public List<Attribute> output()

Description copied from class: QueryPlan

The ordered list of attributes (i.e. columns) this plan produces when executed. Must be called only on resolved plans, otherwise may throw an exception or return wrong results.

Overrides:

output in class RegexExtract

withGeneratedNames

public Grok withGeneratedNames(List<String> newNames)

Description copied from interface: GeneratingPlan

Create a new instance of this node with new output Attributes using the given names. If an output attribute already has the desired name, we continue using it; otherwise, we create a new attribute with a new NameId.

Specified by:

withGeneratedNames in interface GeneratingPlan<RegexExtract>

equals

public boolean equals(Object o)

Overrides:

equals in class RegexExtract

hashCode

public int hashCode()

Overrides:

hashCode in class RegexExtract

parser

public Grok.Parser parser()

rewriteGrokPattern

public static void rewriteGrokPattern(StringBuilder sb,
 String pattern,
 NodeStringMapper mapper)

Renders a Grok pattern of shape "%{IP:client_ip} %{NUMBER:bytes:int}". The Grok library identifier (the part before the first :) is a predefined library name (IP, NUMBER, DATA, ...), not customer data — passes through. The capture name routes through mapper.column. The optional type-coercion suffix after the second colon passes through.